Skip to content

Commit

Permalink
Enable endpoints controller
Browse files Browse the repository at this point in the history
  • Loading branch information
@ishustava
ishustava committed Mar 26, 2021
1 parent 76d9730 commit 3d8c1f3
Show file tree
Hide file tree
Showing 16 changed files with 598 additions and 2,024 deletions.
89 changes: 89 additions & 0 deletions connect-inject/annotations.go
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,89 @@
package connectinject

const (
// annotationStatus is the key of the annotation that is added to
// a pod after an injection is done.
annotationStatus = "consul.hashicorp.com/connect-inject-status"

// annotationInject is the key of the annotation that controls whether
// injection is explicitly enabled or disabled for a pod. This should
// be set to a truthy or falsy value, as parseable by strconv.ParseBool
annotationInject = "consul.hashicorp.com/connect-inject"

// annotationService is the name of the service to proxy. This defaults
// to the name of the first container.
annotationService = "consul.hashicorp.com/connect-service"

// annotationPort is the name or value of the port to proxy incoming
// connections to.
annotationPort = "consul.hashicorp.com/connect-service-port"

// annotationProtocol contains the protocol that should be used for
// the service that is being injected. Valid values are "http", "http2",
// "grpc" and "tcp".
//
// Deprecated: This annotation is no longer supported.
annotationProtocol = "consul.hashicorp.com/connect-service-protocol"

// annotationUpstreams is a list of upstreams to register with the
// proxy in the format of `<service-name>:<local-port>,...`. The
// service name should map to a Consul service namd and the local port
// is the local port in the pod that the listener will bind to. It can
// be a named port.
annotationUpstreams = "consul.hashicorp.com/connect-service-upstreams"

// annotationTags is a list of tags to register with the service
// this is specified as a comma separated list e.g. abc,123
annotationTags = "consul.hashicorp.com/service-tags"

// annotationConnectTags is a list of tags to register with the service
// this is specified as a comma separated list e.g. abc,123
//
// Deprecated: 'consul.hashicorp.com/service-tags' is the new annotation
// and should be used instead. We made this change because the tagging is
// not specific to connect as both the connect proxy *and* the Consul
// service that gets registered is tagged.
annotationConnectTags = "consul.hashicorp.com/connect-service-tags"

// annotationMeta is a list of metadata key/value pairs to add to the service
// registration. This is specified in the format `<key>:<value>`
// e.g. consul.hashicorp.com/service-meta-foo:bar
annotationMeta = "consul.hashicorp.com/service-meta-"

// annotationSyncPeriod controls the -sync-period flag passed to the
// consul-k8s consul-sidecar command. This flag controls how often the
// service is synced (i.e. re-registered) with the local agent.
//
// Deprecated: This annotation is no longer supported.
annotationSyncPeriod = "consul.hashicorp.com/connect-sync-period"

// annotations for sidecar proxy resource limits
annotationSidecarProxyCPULimit = "consul.hashicorp.com/sidecar-proxy-cpu-limit"
annotationSidecarProxyCPURequest = "consul.hashicorp.com/sidecar-proxy-cpu-request"
annotationSidecarProxyMemoryLimit = "consul.hashicorp.com/sidecar-proxy-memory-limit"
annotationSidecarProxyMemoryRequest = "consul.hashicorp.com/sidecar-proxy-memory-request"

// annotations for metrics to configure where Prometheus scrapes
// metrics from, whether to run a merged metrics endpoint on the consul
// sidecar, and configure the connect service metrics.
annotationEnableMetrics = "consul.hashicorp.com/enable-metrics"
annotationEnableMetricsMerging = "consul.hashicorp.com/enable-metrics-merging"
annotationMergedMetricsPort = "consul.hashicorp.com/merged-metrics-port"
annotationPrometheusScrapePort = "consul.hashicorp.com/prometheus-scrape-port"
annotationPrometheusScrapePath = "consul.hashicorp.com/prometheus-scrape-path"
annotationServiceMetricsPort = "consul.hashicorp.com/service-metrics-port"
annotationServiceMetricsPath = "consul.hashicorp.com/service-metrics-path"

// annotationEnvoyExtraArgs is a space-separated list of arguments to be passed to the
// envoy binary. See list of args here: https://www.envoyproxy.io/docs/envoy/latest/operations/cli
// e.g. consul.hashicorp.com/envoy-extra-args: "--log-level debug --disable-hot-restart"
// The arguments passed in via this annotation will take precendence over arguments
// passed via the -envoy-extra-args flag.
annotationEnvoyExtraArgs = "consul.hashicorp.com/envoy-extra-args"

// annotationConsulNamespace is the Consul namespace the service is registered into.
annotationConsulNamespace = "consul.hashicorp.com/consul-namespace"

// injected is used as the annotation value for annotationInjected
injected = "injected"
)
89 changes: 26 additions & 63 deletions connect-inject/consul_sidecar.go
View file
Original file line number Diff line number Diff line change
@@ -1,89 +1,52 @@
package connectinject

import (
"errors"
"fmt"
"strings"

corev1 "k8s.io/api/core/v1"
)

// consulSidecar starts the consul-sidecar command to only run
// the metrics merging server when metrics merging feature is enabled.
// It always disables service registration because for connect we no longer
// need to keep services registered as this is handled in the endpoints-controller.
func (h *Handler) consulSidecar(pod corev1.Pod) (corev1.Container, error) {
command := []string{
"consul-k8s",
"consul-sidecar",
"-service-config", "/consul/connect-inject/service.hcl",
"-consul-binary", "/consul/connect-inject/consul",
}
if h.AuthMethod != "" {
command = append(command, "-token-file=/consul/connect-inject/acl-token")
}

if period, ok := pod.Annotations[annotationSyncPeriod]; ok {
command = append(command, "-sync-period="+strings.TrimSpace(period))
}

run, err := h.shouldRunMergedMetricsServer(pod)
if err != nil {
return corev1.Container{}, err
}

// If we need to run the merged metrics server, configure consul
// sidecar with the appropriate metrics flags.
if run {
mergedMetricsPort, err := h.mergedMetricsPort(pod)
if err != nil {
return corev1.Container{}, err
}
serviceMetricsPath := h.serviceMetricsPath(pod)

// Don't need to check the error since it's checked in the call to
// h.shouldRunMergedMetricsServer() above.
serviceMetricsPort, _ := h.serviceMetricsPort(pod)

command = append(command, []string{
"-enable-metrics-merging=true",
fmt.Sprintf("-merged-metrics-port=%s", mergedMetricsPort),
fmt.Sprintf("-service-metrics-port=%s", serviceMetricsPort),
fmt.Sprintf("-service-metrics-path=%s", serviceMetricsPath),
}...)
// This should never happen because we only call this function in the handler if
// we need to run the metrics merging server. This check is here just in case.
if !run {
return corev1.Container{}, errors.New("metrics merging should be enabled in order to inject the consul-sidecar")
}

envVariables := []corev1.EnvVar{
{
Name: "HOST_IP",
ValueFrom: &corev1.EnvVarSource{
FieldRef: &corev1.ObjectFieldSelector{FieldPath: "status.hostIP"},
},
},
// Configure consul sidecar with the appropriate metrics flags.
mergedMetricsPort, err := h.mergedMetricsPort(pod)
if err != nil {
return corev1.Container{}, err
}
serviceMetricsPath := h.serviceMetricsPath(pod)

if h.ConsulCACert != "" {
envVariables = append(envVariables,
// Kubernetes will interpolate HOST_IP when creating this environment
// variable.
corev1.EnvVar{
Name: "CONSUL_HTTP_ADDR",
Value: "https://$(HOST_IP):8501",
},
corev1.EnvVar{
Name: "CONSUL_CACERT",
Value: "/consul/connect-inject/consul-ca.pem",
},
)
} else {
envVariables = append(envVariables,
// Kubernetes will interpolate HOST_IP when creating this environment
// variable.
corev1.EnvVar{
Name: "CONSUL_HTTP_ADDR",
Value: "$(HOST_IP):8500",
})
// Don't need to check the error since it's checked in the call to
// h.shouldRunMergedMetricsServer() above.
serviceMetricsPort, _ := h.serviceMetricsPort(pod)

command := []string{
"consul-k8s",
"consul-sidecar",
"-enable-service-registration=false",
"-enable-metrics-merging=true",
fmt.Sprintf("-merged-metrics-port=%s", mergedMetricsPort),
fmt.Sprintf("-service-metrics-port=%s", serviceMetricsPort),
fmt.Sprintf("-service-metrics-path=%s", serviceMetricsPath),
}

return corev1.Container{
Name: "consul-sidecar",
Image: h.ImageConsulK8S,
Env: envVariables,
VolumeMounts: []corev1.VolumeMount{
{
Name: volumeName,
Expand Down
Loading

0 comments on commit 3d8c1f3

Please sign in to comment.